This is the accessible text file for GAO report number GAO-07-70 
entitled 'Export Controls: Agencies Should Assess Vulnerabilities and 
Improve Guidance for Protecting Export-Controlled Information at 
Universities' which was released on December 5, 2006. 

This text file was formatted by the U.S. Government Accountability 
Office (GAO) to be accessible to users with visual impairments, as part 
of a longer term project to improve GAO products' accessibility. Every 
attempt has been made to maintain the structural and data integrity of 
the original printed product. Accessibility features, such as text 
descriptions of tables, consecutively numbered footnotes placed at the 
end of the file, and the text of agency comment letters, are provided 
but may not exactly duplicate the presentation or format of the printed 
version. The portable document format (PDF) file is an exact electronic 
replica of the printed version. We welcome your feedback. Please E-mail 
your comments regarding the contents or accessibility features of this 
document to Webmaster@gao.gov. 

This is a work of the U.S. government and is not subject to copyright 
protection in the United States. It may be reproduced and distributed 
in its entirety without further permission from GAO. Because this work 
may contain copyrighted images or other material, permission from the 
copyright holder may be necessary if you wish to reproduce this 
material separately. 

Report to the Committee on the Judiciary, House of Representatives: 

United States Government Accountability Office: 

GAO: 

December 2006: 

Export Controls: 

Agencies Should Assess Vulnerabilities and Improve Guidance for 
Protecting Export-Controlled Information at Universities: 

GAO-07-70: 

GAO Highlights: 

Highlights of GAO-07-70, a report to the Chairman, Committee on the 
Judiciary, House of Representatives 

Why GAO Did This Study: 

Foreign students and scholars have made substantial contributions to 
U.S. research efforts and technology development. However, according to 
a federal government intelligence assessment, foreign access to 
sensitive U.S. technology has imposed a significant but unquantifiable 
cost to the United States. 

Given this risk, GAO was asked to (1) describe the nature of the 
research at universities and identify steps they take to comply with 
export controls and (2) assess efforts by the Departments of Commerce 
and State—the key export control agencies—to determine the risk of 
export violations in university research. GAO reviewed Commerce and 
State export control programs and met with officials from 13 
universities, selected based on their foreign student populations, 
applications for export licenses, and federal grants and contracts. 

What GAO Found: 

The U.S. export control system requires export licensing for defense 
items and items that have both commercial and military applications, 
except where exclusions apply, such as those applicable to universities 
in some circumstances. The U.S. export control agencies place the onus 
on universities to understand and comply with the regulations. 
According to university officials we interviewed, their institutions 
focus almost exclusively on fundamental research—defined as basic and 
applied research in science and engineering, the results of which 
ordinarily are published and shared broadly within the scientific 
community. Such research is generally not subject to export controls. 
Universities we visited conduct research in such areas as 
nanotechnologies, computer security, and chemical engineering. To 
ensure their research remains in the public domain, university 
officials said they negotiate contract language to remove publication 
or other dissemination restrictions for research they consider to be 
fundamental. If export controls apply, university officials stated they 
sometimes involve only those students eligible to conduct the research 
under a license exclusion, to avoid the lengthy license application 
process. In other cases, they refer such work to off-campus associated 
facilities that can better regulate and control foreign national access 
to the research. Universities we visited indicated that government-
provided training and guidance on export control regulations is limited 
in informing their efforts to manage and protect export-controlled 
information in the university environment. 

State and Commerce officials expressed concerns that universities may 
not correctly interpret and apply export regulations, given the large 
number of foreign students participating in research at universities 
and the relative lack of license applications from universities. 
Although federal internal control standards contain guidelines for 
agencies to conduct risk assessments, State and Commerce have not 
conducted an overall assessment of available trend data on technology 
development research and foreign participation in such research at U.S. 
universities to identify potential vulnerabilities. For example, U.S. 
government agencies collect data on foreign student nationality, school 
enrollment, and types of research conducted at universities for federal 
agencies, which could supplement information that State and Commerce 
receive from visa application processes and other sources. Although 
State and Commerce provide guidance through training seminars, agency 
Web sites, and telephone help desks to assist exporters in 
understanding and complying with regulations, officials stated that 
their focus is on processing export license applications—primarily from 
industry. Recently, Commerce established an advisory committee composed 
of industry and university representatives who are expected to discuss 
issues such as the nature of university research and its relation to 
export controls. 

What GAO Recommends: 

GAO recommends that Commerce and State use available information to 
assess potential vulnerabilities and based on this assessment improve 
outreach, guidance, and interagency coordination. The agencies 
generally concurred, but State disagreed with our recommendation on 
assessing vulnerabilities. Broader assessments would increase State’s 
knowledge of risks and help improve its guidance to universities. 

[Hyperlink, http://www.gao.gov/cgi-bin/getrpt?GAO-07-70]. 

To view the full product, including the scope and methodology, click on 
the link above. For more information, contact John Hutton at (202) 512-
7773 or huttonj@gao.gov. 

[End of Section] 

Contents: 

Letter: 

Results in Brief: 

Background: 

Universities Focus on Fundamental Research to Comply with Export 
Regulations: 

State and Commerce Have Not Assessed the Potential Risk to Export- 
Controlled Information at Universities: 

Conclusions: 

Recommendations for Executive Actions: 

Agency Comments and our Evaluation: 

Appendix I: Scope and Methodology: 

Appendix II: Comments from the Department of Commerce: 

Appendix III: Comments from the Department of State: 

Appendix IV: Staff Contact and Acknowledgments: 

Table: 

Table 1: Examples of Research Areas Conducted at Universities Visited 
by GAO: 

Figure: 

Figure 1: Basic and Applied U.S.-Based Research Funding Sources for 
Universities and Colleges in Fiscal Year 2003: 

Abbreviations: 

BIS: Bureau of Industry and Security: 

DDTC: Directorate of Defense Trade Controls: 

DOD: Department of Defense: 

EAR: Export Administration Regulations: 

ITAR: International Traffic in Arms Regulations: 

NASA: National Aeronautics and Space Administration: 

SEVIS: Student and Exchange Visitor Information System: 

United States Government Accountability Office: 

Washington, DC 20548: 

December 5, 2006: 

The Honorable F. James Sensenbrenner, Jr. 
Chairman: 
Committee on the Judiciary: 
House of Representatives: 

Dear Mr. Chairman: 

U.S. national security and economic interests are heavily dependent on 
technological innovation and advantage. Many of the nation's leading- 
edge technologies, including defense-related technologies, are being 
discovered by American and foreign national students and scholars in 
U.S. university research and university-affiliated laboratories. As the 
Department of Defense (DOD) invests less and less of its funding on in- 
house research and development, university-based discoveries are 
becoming increasingly vital to national security and other U.S. 
interests. 

To mitigate the risk of technology and knowledge falling into the wrong 
hands, the U.S. government--primarily the Departments of State and 
Commerce--controls the transfer of defense and "dual use" 
information.[Footnote 1] However, controlling the transfer of such 
information presents special challenges. U.S. export control 
regulations allow foreign students and researchers without export 
licenses to partake in fundamental research, defined to mean basic and 
applied research in science and engineering, the results of which are 
ordinarily published and shared broadly within the scientific 
community.[Footnote 2] U.S. policymakers recognize that foreign 
students and researchers have made substantial contributions to U.S. 
research efforts, but the potential transfer of knowledge of controlled 
defense-related technologies to their home countries could have 
significant consequences for U.S. national interests. In a September 
2005 testimony before Congress, the National Counterintelligence 
Executive stated that while the vast majority of foreign students in 
the United States are legitimately studying and advancing academic 
pursuits, some seek to acquire sensitive U.S. technologies to advance 
their own countries' economic and military interests. Additionally, 
while not limited to foreign students, a 2005 federal report noted that 
the technology lost as a result of foreign efforts to target sensitive 
U.S. technologies has imposed a significant, but difficult to quantify, 
cost on the United States.[Footnote 3] 

On the basis of your interest in continuing to attract foreign students 
and researchers to U.S. universities while protecting export-controlled 
information, you asked us to look at how academic institutions and the 
U.S. government protect against the illegal disclosure of such 
information. In response, we (1) described the nature of the research 
conducted at universities and identified the steps they have taken to 
comply with government export control regulations and (2) assessed the 
efforts of the Departments of Commerce and State to determine the risk 
of export violations in university research. 

To conduct our work, we met with officials from the Departments of 
Commerce and State and analyzed their regulations, guidance, and 
training. We also met with officials in the Department of Defense-- 
which participates in the export control regulatory process--and the 
Department of Homeland Security--which has responsibility for tracking 
foreign students and scholars during their course of study in the 
United States. We visited 13 universities that were systematically 
selected based on their international student populations, export 
license applications, and federal grants and contracts. At the 
universities, we spoke with officials in such positions as vice 
chancellor for research, director of compliance, and general counsel, 
among others. While our selection criteria included a range of 
university experiences with export controls and foreign students and 
scholars, the universities' views stated in this report do not 
represent the entirety of the U.S. academic community. We also spoke 
with officials from various research institutes and academic 
associations. Additional details on the scope and methodology of our 
review can be found in appendix I. We conducted our review from March 
through November 2006 in accordance with generally accepted government 
auditing standards. 

Results in Brief: 

According to university officials we interviewed, their institutions 
focus almost exclusively on fundamental research, which is generally 
not subject to export controls. By conducting fundamental research in 
areas such as artificial intelligence, nanotechnology, and robotics, 
universities can openly share and publish their research findings 
within a broad community that includes international students and 
scholars. To ensure their research remains in the public domain, most 
university officials said they extensively screen and review potential 
contracts and grants for fundamental research to ensure there are no 
publication or other dissemination restrictions. If export controls 
apply, university officials stated they sometimes reject the research 
contract, involve only students and scholars who can conduct the 
research under license exclusions, or refer such work to associated 
facilities and laboratories located off-campus that can better regulate 
and control foreign national access to such research. The U.S. export 
control system relies on universities to understand and correctly 
determine when export regulations apply and to follow the regulations 
accordingly. To educate themselves on export control issues, academic 
officials take training courses offered through Commerce, State, and 
university associations; search government and other Web sites; request 
guidance from knowledgeable officials at other universities; and hire 
outside legal counsel and expertise on export controls. However, the 
universities we visited indicated that government-provided training and 
guidance on export regulations is limited in informing their efforts to 
manage and protect export-controlled information, and it does not 
clarify when fundamental research exclusions should apply. 

Although State and Commerce provide some guidance and training to 
assist exporters in understanding and complying with export 
regulations, these agencies have not fully assessed the potential for 
transfers of export-controlled information to foreign nationals in the 
course of U.S. university research. State and Commerce target their 
resources to processing license applications and provide assistance to 
exporters through guidance, training, and other outreach. However, they 
rarely coordinate these efforts or strategize their outreach on export 
controls to the academic community. Furthermore, officials expressed 
concerns that universities may not correctly interpret and apply export 
regulations--a concern raised by the rarity of export license 
applications from U.S. academic institutions, considering the large 
foreign student and scholar populations studying and conducting 
research in the United States. However, the agencies have not conducted 
an overall assessment of available data on foreign participation in 
research at U.S. universities to determine whether such research would 
require export protections. For example, U.S. government agencies 
collect data on foreign student nationality, school enrollment, and 
federally-funded research conducted at universities, which could 
supplement information that State and Commerce receive from visa 
application processes and other leads. Furthermore, State and Commerce 
outreach efforts have been largely reactive, and they have only 
recently begun to engage with the affected research community in forums 
to promote dialogue on issues such as fundamental research and its 
relation to export controls. 

To improve their oversight of export-controlled information at 
universities, we are recommending that the Secretaries of Commerce and 
State direct their export control entities to strategically assess 
potential vulnerabilities in the conduct and publication of academic 
research through analyzing available information on technology 
development and foreign student populations at universities. This could 
help to determine the extent to which research at universities may be 
subject to export controls. Furthermore, we recommend that, on the 
basis of this assessment, Commerce and State further coordinate efforts 
and improve guidance and outreach to ensure that universities 
understand when to apply export controls. 

The Department of Commerce generally agreed with our report and 
indicated that it has undertaken efforts to increase its outreach to 
the academic community and plans to further assess vulnerabilities and 
more precisely target outreach and compliance efforts. The Department 
of State agreed with our recommendation to improve interagency 
coordination on training and guidance for universities and disagreed 
with our report's finding that it does not assess the potential 
vulnerabilities associated with export-controlled information at 
academic institutions. However, we maintain that a trend analysis of 
available data on foreign students and scholars and federal contracts 
for research at academic institutions would be a valuable investment in 
providing a proactive plan for targeting outreach and training for the 
academic community. While State disagreed with our recommendation, in 
its response it noted that it is considering conducting such an 
assessment. In addition, the Departments of State and Homeland Security 
provided technical comments that were incorporated as appropriate 
throughout the report. The Department of Defense had no comments on 
this report. 

Background: 

In November 2003, GAO reported that university research is a vital part 
of the nation's research and development efforts, primarily funded by 
the federal government because of the broad consensus that university 
research is a long-term national investment in the future.[Footnote 4] 
The federal investment in university research has yielded thousands of 
inventions each year that have fostered the development of new 
technologies, stimulated the creation of new jobs, and improved the 
quality of life. These benefits come through open communication among 
scientists and the sharing of research results. A National Academy of 
Sciences official underscored the importance of this issue in September 
2005 congressional testimony, stating that over 55 percent of the 
engineering Ph.D. students in the United States are foreign-born and 
that their research helps strengthen the United States in the fastest- 
moving new technologies, some of which have potential defense-related 
application.[Footnote 5] 

Foreign students and scholars bring needed skills to our increasingly 
knowledge-based economy, build bridges to other countries and 
professional communities, and make other valuable contributions to our 
society. These contributions are particularly important for maintaining 
our competitiveness, fostering productivity and innovation, and 
strengthening our workforce. While the United States has long been a 
global leader in higher education and one of the most desired 
destinations for foreign students, international competition for the 
best and the brightest students and scholars is growing. Countries such 
as China have improved their educational capacities, possibly 
decreasing the incentives for students and scholars to study in the 
United States. The recent slowing of foreign student enrollment in 
United States universities and colleges has raised concerns about the 
extent to which we will be able to continue attracting talented foreign 
students and researchers to our universities and to our workforce after 
they graduate while also maintaining our nation's security. 

Recognizing the importance of balancing national security interests 
with the need to allow the free exchange of information at U.S. 
academic institutions of higher learning, the federal government is a 
major funding source for research conducted at U.S. universities and 
colleges. In fiscal year 2003, the federal government funded almost two-
thirds--approximately $29.6 billion--of all basic and applied research 
funding provided to universities and colleges by external sources (see 
fig. 1). Other sources of funding come from industry, nonprofit 
organizations, as well as state and local governments. 

Figure 1: Basic and Applied U.S.-Based Research Funding Sources for 
Universities and Colleges in Fiscal Year 2003: 

[See PDF for image] 

Source: National Science Foundation data, GAO analysis. 

[A] "Other" includes universities, colleges, and state and local 
governments. 

[End of figure] 

According to National Science Foundation data for fiscal year 2003, the 
National Institutes of Health of the Department of Health and Human 
Services funded approximately 62 percent (about $14.1 billion) of all 
federally funded science and technology research conducted by 
universities and colleges. Other federal research funding sources 
identified by university officials we spoke with include the National 
Aeronautics and Space Administration (NASA); the National Science 
Foundation; various Department of Defense agencies, including the Navy 
and the Defense Advanced Research Projects Agency; and the Departments 
of Energy, State, and Transportation. This level of government funding 
was consistent with that of several of the universities we visited, 
where officials stated that their research is primarily funded by 
government grants and contracts, including contracts that are directed 
toward industry and subsequently subcontracted, or "flowed through," to 
universities. 

Over the past several decades in which the current export control 
system has been in effect, the global economy has changed 
significantly. DOD continues to seek innovative technologies to meet 
the needs of warfighters and to counter technologies developed by 
potential U.S. adversaries. To achieve these ends, DOD has become more 
willing to rely on the nondefense industry to supply its needs. DOD 
increasingly relies on commercial research, for areas such as 
information systems and telecommunications, where the cutting edge of 
technological advancement lies. Such advances in communications 
technology have been made possible to a large extent by basic research, 
much of which was initially developed in universities and often 
involved foreign students and scholars. 

The U.S. export control system relies on the ability of exporters to 
recognize when certain goods and services meet the criteria for 
requiring an export license. The system is primarily divided between 
two regulatory regimes, one managed by the Department of State and 
another managed by the Department of Commerce. The regimes require 
export licensing for defense-related items and information, including 
data, except where exclusions apply. Both regulatory regimes include 
exclusions applicable in some circumstances to universities and other 
academic institutions of higher learning. The U.S. export control 
system places the onus on universities and other exporters to 
understand and comply with the export control regulations. 

The Department of State Directorate of Defense Trade Controls (DDTC) 
manages defense items through the International Traffic in Arms 
Regulations (ITAR).[Footnote 6] State issues export licenses based on 
the U.S. Munitions List, which identifies defense articles, services, 
and related technical data that are controlled for export. Moreover, 
the regulations state that unless otherwise expressly exempted or 
excluded, an export license is required for the oral, visual, or 
documentary transmission of technical data by U.S. persons to foreign 
persons,[Footnote 7] by such means as in-person or telephone 
discussions and written correspondence including electronic messages, 
even when they are in the United States. The U.S. Munitions List 
contains 21 categories, covering items such as weapons, chemical and 
biological agents, missiles, and both commercial and military 
satellites. 

The Department of Commerce's Bureau of Industry and Security (BIS) 
manages dual-use items, having both military and commercial 
applications, through the Export Administration Regulations 
(EAR).[Footnote 8] Under these regulations, exporters are to obtain 
prior government authorization in the form of a license from BIS, or 
determine that a license is not needed, before exporting dual-use 
items. Commerce requires an export license for the release of 
technology or software source code to a foreign national[Footnote 9] 
because such a release is deemed to be an export[Footnote 10] to the 
home country or countries of the foreign national, even if the person 
is in the United States. Commerce regulates the dual-use items 
specified in the EAR's Commerce Control List, which are controlled for 
a variety of reasons, including restricting exports that could 
significantly enhance a country's military potential, preventing 
exports to countries that sponsor terrorism, and limiting the 
proliferation of chemical, biological, and nuclear weapons and their 
delivery systems. The Commerce Control List has 10 categories covering 
items such as electronics, computers, telecommunications, and avionics. 

Universities Focus on Fundamental Research to Comply with Export 
Regulations: 

Most of the universities we visited aim to ensure that their research 
remains unrestricted and in the public domain by conducting fundamental 
research, which is generally excluded from export controls. To ensure 
that most of the research conducted on their campuses does not require 
an export license, these universities negotiate to exclude any 
restrictions on publishing and disseminating the results of the 
research they consider to be fundamental. For research that may be 
subject to export control regulations, the universities we visited have 
taken steps to ensure that their personnel are informed about and 
comply with these regulations. 

Universities Focus on Conducting Fundamental Research: 

According to most university officials, their institutions conduct 
basic and applied science and engineering research in a wide variety of 
areas, producing findings that are conducted, shared, and published 
openly within a broad community that includes international students 
and scholars. Table 1 lists examples of research areas conducted at 
universities that we visited. 

Table 1: Examples of Research Areas Conducted at Universities Visited 
by GAO: 

* Artificial intelligence; 
* Atmospheric research; 
* Biological sciences; 
* Chemical engineering; 
* Computational science and computer architecture; 
* Computer security; 
* Integrated circuit design and fabrication; 
* Internet communications and advanced networking; 
* Nanotechnologies; 
* Physics; 
* Remote sensing of Earth; 
* Robotics. 

Source: GAO analysis of universities' Web sites. 

[End of table] 

Most officials we spoke with stated that their universities 
specifically seek out research contracts and grants that do not 
restrict their ability to conduct fundamental research by extensively 
screening and reviewing the terms of potential contracts and grants. If 
a contract includes restrictions on fundamental research, some 
universities attempt to negotiate the restrictive language out of the 
contract. Some university officials noted that such negotiations have 
become more frequent because government and industry contracting 
officials are increasingly inserting restrictive language in contracts 
for research that universities consider to be fundamental. For example, 
according to university officials, DOD agencies sometimes insert 
standard acquisition regulations language that prohibits the contractor 
from releasing information, even unclassified information, outside of 
the contractor's organization.[Footnote 11] According to university 
officials, a rule proposed by DOD would have restricted universities 
from sharing information with other academic institutions and 
publishing research or otherwise making such information available in 
the public domain.[Footnote 12] DOD revised the rule to minimize the 
impact on fundamental research conducted at universities and 
acknowledged that the free exchange of ideas is a foundational concept 
of U.S. research and educational institutions.[Footnote 13] Several 
universities we interviewed stated that if they are unsuccessful in 
negotiating the restrictive language out of those research contracts 
they consider to be fundamental, they sometimes reject the opportunity 
to participate in the research. 

For research subject to export control restrictions, universities may 
modify the way the research is conducted to avoid the export license 
application process--a process some officials characterized as time- 
consuming and complicated. For example, officials at one university 
said that instead of applying for an export license for one project, 
they opted to use only researchers who are excluded from export license 
requirements, such as U.S. citizens or foreign nationals with permanent 
residency status. In other cases, university officials stated they move 
export-controlled work to off-campus facilities and laboratories 
administered by the universities or the entity sponsoring the contract, 
where such research can be better segregated and controlled. At the six 
university-administered laboratories that we visited, each used access 
control systems such as badges and computer passwords. Such 
restrictions limiting access to information at laboratories are not as 
common on the main campuses we visited, where research information is 
more openly available. 

Efforts Undertaken by Universities to Understand and Comply with Export 
Control Regulations: 

According to a State official, U.S. export control regulations are 
designed for "self-compliance." For the academic community 
specifically, State officials said that it is the universities' 
responsibility to conduct due diligence to determine whether their 
research activities are subject to export laws, and to identify whether 
an export license is required for foreign nationals within their 
purview. University officials we spoke with have taken actions to 
become educated on complex export control regulations--an undertaking 
that several officials indicated requires an extensive time commitment 
because the government does not provide sufficient guidance. Some 
universities have also dedicated other resources to ensure they comply 
with U.S. export control laws, such as hiring legal counsel. 

To understand export control regulations, universities we visited 
frequently rely on agency training and guidance. Several university 
officials stated that they had attended training seminars sponsored by 
Commerce, as well as conferences sponsored by the Society for 
International Affairs, a nonprofit defense trade industry association 
that sponsors events such as conferences and workshops to educate and 
instruct the export community on all aspects of defense and commercial 
exports and technology transfers.[Footnote 14] Most university 
officials indicated that they also accessed Commerce and State Web 
sites or their respective telephone help desks. 

However, several university officials indicated that the agency 
training and guidance have limited utility for academic institutions. 
For example, according to some university officials, training provided 
by Commerce and State does not discuss how export regulations apply to 
universities that have fundamental research exclusions. One university 
official characterized the Commerce-sponsored session that he attended 
as being "entry level" training directed at the corporate community. 
Commerce officials have acknowledged that about 95 percent of the 
attendees at their seminars are repeat attendees, primarily from 
industry. Some university officials stated that the training was too 
narrowly focused on topics that do not pertain to universities. 
University officials also raised concerns with State's and Commerce's 
Web-based guidance. Some university officials characterized the Web- 
based information provided by Commerce and State as being unclear or 
only providing a general introduction to a topic without providing 
sufficient details to fully answer questions concerning export 
controls. For example, a university official stated that the Commerce 
and State Web sites do not identify which forms universities need to 
submit in seeking export licenses to involve foreign researchers in 
certain research. Also, although some university officials indicated 
that Commerce and State officials provide very useful information via 
the telephone help desks, they stated that getting immediate help was 
difficult at times and that return messages were untimely. 

To further their understanding of export control regulations, several 
universities have sought out other sources of information, specifically 
sources tailored to universities. Several university officials 
indicated that they rely on best practices by other universities that 
have shared and developed approaches for addressing different export 
control issues, including the Massachusetts Institute of Technology, 
Stanford University, and the Universities of Oklahoma and Maryland. For 
example, officials from one university said that they have relied on 
other universities for guidance on applying for export licenses. 
Universities and academic associations exchange best practice 
information through seminars and workshops sponsored by nongovernmental 
organizations, such as the Association of American Universities, the 
Council on Governmental Relations, and the National Council of 
University Research Administrators. 

Many of the universities that we visited have also developed written 
guidance and training to help educate university personnel on their 
responsibility to comply with the export control regulations. For 
example, officials from one university we visited have developed a Web- 
based decision tree to assist university personnel in determining the 
applicability of export controls to their research projects. Officials 
from another university stated that their research institution requires 
that all staff take training--available on the university's intranet 
site--related to the handling of controlled information. Another 
university adopted a targeted strategy of export control education for 
its researchers, reaching out to the researchers and programs most 
likely to be affected by export controls, such as those in engineering. 

A number of universities we visited have invested in other resources to 
ensure they comply with export control regulations. Some hire outside 
legal counsel who specialize in export controls. For example, one 
university routinely employs outside counsel to mitigate the risk of 
committing violations, because of the severity of the penalties for 
noncompliance.[Footnote 15] According to officials at another 
university, thousands of dollars are spent each year for legal services 
addressing export controls. Finally, two universities we visited use a 
software program to help determine if a proposed research project grant 
or contract is subject to export license requirements. According to 
officials at these two universities, the software program helps to 
facilitate a process that is very difficult, time-consuming, and costly 
because of the length and complexity of U.S. export control 
regulations. 

State and Commerce Have Not Assessed the Potential Risk to Export- 
Controlled Information at Universities: 

State and Commerce officials indicated that their top priority is 
processing the thousands of license applications received annually--the 
vast majority of which are from industry--leaving few resources for 
guidance and outreach to exporters. However, they expressed concerns 
that universities may be misinterpreting their responsibilities under 
export regulations and that the potential may exist for foreign 
nationals to access sensitive information on U.S. campuses. Despite 
these concerns, neither agency has analyzed available information on 
university research and foreign student populations to determine the 
potential risk of the illegal transfer of controlled information. 

Commerce and State Prioritize Processing of License Applications and 
Target Their Resources to Industry: 

According to Commerce officials, BIS receives approximately 1,000 
deemed export license applications per year. Officials confirmed that 
most of these applications are received from industry. For example, 
Commerce officials stated that of the 865 deemed export licenses 
processed by Commerce in fiscal year 2006, 99.7 percent were from 
industry. These same officials noted that over the last few years, only 
two universities have submitted deemed export license applications. A 
2004 Commerce Inspector General report stated that license application 
data suggest that many industries (including chemical and biotechnology 
industries), academic institutions, and federal research facilities 
that may employ or host foreign nationals are not applying for deemed 
export licenses. 

State and Commerce officials stated that beyond processing export 
licenses, few resources remain for providing outreach and guidance to 
the export community. While both agencies provide guidance and outreach 
through conferences cosponsored with other organizations and agency- 
sponsored training, much of their outreach is directed at industry, and 
not the academic community. Commerce cosponsors approximately 45 formal 
seminars annually, along with specialty seminars on deemed exports 
ranging from basic to advanced. As its principal training activity, 
State provides speakers for export licensing conferences that are 
organized by the Society for International Affairs and tailored to the 
needs of industry and government participants. An official acknowledged 
that State is unable to fill all of the speaking requests that it 
receives, which number in the hundreds each year. Instead, State 
responds to requests based on the availability of personnel and travel 
funds. From January 2004 through June 2006, State officials approved 
their personnel to participate in approximately 135 outreach activities 
and events. 

Officials at both agencies indicated that their visits to or staffing 
of training seminars for the academic community are often in response 
to specific invitations from universities. A State official who is 
responsible for export outreach reported that since 2003, only one 
event has been held that was specifically targeted to the academic 
community. While State policy officials have indicated that they would 
like to conduct more conferences for universities in the future, the 
official responsible for these conferences stated that none are 
currently scheduled because of limited resources. For Commerce, one 
official has noted that more universities have recently begun attending 
its training seminars. However, while Commerce stated it has increased 
its outreach to universities in the last few years, GAO analysis of its 
outreach records indicated that several events that Commerce 
categorized as targeted at universities were provided to government 
research entities instead. 

In addition to conferences and agency-provided training, both State and 
Commerce maintain telephone help desks and Web sites for exporters to 
obtain guidance on export controls. State employs a three-person 
response team to answer telephone inquiries and provide informal advice 
on export control issues in response to the thousands of calls received 
monthly from industry and academic institutions. Officials have 
indicated that they have improved help desk response times. Commerce's 
and State's Web sites provide exporters with guidance on when a license 
is needed and how a license can be procured. However, information is 
aimed at a more general audience, although a Commerce official stated 
that the agency has posted more background information on the 
fundamental research exclusion on its Web site. State officials noted 
that they have made their Web site more user-friendly and taken steps 
to expand the Web site to provide additional guidance to exporters. 

Although State and Commerce have separate export control jurisdictions, 
the 2004 interagency Offices of Inspector General report stated that 
Commerce and State could improve their outreach by providing joint 
training that explains the differences between the two agencies' 
licensing requirements and procedures--a recommendation that, according 
to the report, was supported by company and academic 
officials.[Footnote 16] Furthermore, previous GAO reports have 
recommended that Commerce and State should better coordinate their 
efforts on analysis and export oversight.[Footnote 17] However, State 
and Commerce have taken few actions to coordinate their outreach 
efforts to universities. Though State engaged in six outreach events 
with Commerce between November 2003 and April 2004, a State official 
explained that staffing such joint events with Commerce remains 
difficult because State must use personnel from its licensing staff to 
participate in these events. With a backlog in license applications, 
the processing of applications is a priority, and the agency is 
reluctant to divert those personnel to outreach efforts. 

Commerce and State Have Not Conducted Analysis to Identify whether Any 
Risk Exists to Export-Controlled Information at Universities: 

State and Commerce officials expressed concerns that despite the export 
control exclusions for university research, the potential may exist for 
foreign nationals to access controlled defense and dual-use 
technologies and information on U.S. campuses. However, neither State 
nor Commerce has analyzed available data on university research 
contracts or student fields of study to identify any potential risk to 
export-controlled information at universities. According to federal 
internal control standards, agencies need to conduct risk assessments 
that generally include estimating the risk's significance and 
likelihood of occurrence, deciding how to manage the risk and 
determining what actions should be taken.[Footnote 18] 

In the absence of an assessment of export control vulnerabilities at 
universities, State officials and a Commerce Inspector General report 
stated they were concerned that academic officials may be 
misinterpreting export control regulations and guidance. According to 
State officials, universities are unaware of the nuances of export 
control regulations. Specifically, they said universities have 
difficulty distinguishing and tracking export regulations when a 
specific project develops from basic to fundamental or applied 
research. For example, one State official questioned whether 
universities devote sufficient resources to export compliance and apply 
for export licenses with State and Commerce to the extent their 
research activities warrant. This official believes that academic 
institutions should designate individuals responsible for understanding 
export control regulations and tracking exports, just as companies do. 
However, most of the academic institutions we visited had designated 
officials who were responsible for export control issues. 

Despite these concerns, Commerce and State have not fully assessed 
university compliance information to identify the potential for export 
control vulnerabilities in university research. Commerce and State are 
tasked with export control oversight, including administering policy, 
processing licenses, and reviewing compliance by exporters. According 
to State officials, the department lacks the personnel to conduct 
extensive compliance audits. Instead, State relies on voluntary 
disclosure of possible export control violations--primarily by 
companies. When a company notifies State of a possible export 
violation, State may visit the company to discuss the problem and offer 
advice on weaknesses in the company's export control program. According 
to State officials, State does not target universities for compliance 
and has not visited a university because universities make up a small 
percentage of all exporters. Officials stated that Commerce's formal 
compliance review program is focused on deemed export license holders, 
the majority of which are from industry. Commerce does not conduct 
analyses to determine whether academic institutions that have not 
applied for licenses are in compliance with export control regulations. 
Instead, Commerce uses leads generated by intelligence agencies, 
internal Commerce sources, or the public via a hotline to investigate 
possible cases of export control violations. 

Furthermore, although Commerce gathers information about certain 
universities' research activities on case-by-case basis, neither 
Commerce nor State analyzes available federal agency data on university 
research subjects to identify trends or determine the potential for 
such research to be subject to export control regulations. Given that 
much of the research conducted at U.S. universities is federally 
funded, data from other government agencies on the subjects of research 
conducted at academic institutions could supplement data from Commerce 
and State. For example, DOD and NASA fund research at universities, 
some of which involves technologies that could become export 
controlled. General information on federal contracts available through 
the Federal Procurement Data System could also provide information on 
universities doing high volumes of research for other federal agencies. 
However, neither Commerce nor State makes use of these data sources to 
analyze trends in university research. Commerce, instead, relies on 
Internet searches or publicly available data on university research 
when preparing to meet with academic officials. 

Other data could help Commerce and State identify potential risks of 
export control violations at academic institutions. Commerce officials 
stated that some foreign nationals on U.S. campuses are from countries 
that have historically tried to unlawfully obtain information about 
American technologies. However, while Commerce uses visa application 
data to generate leads for specific cases of deemed export violations, 
it does not use other data on foreign students' and scholars' majors or 
fields of study to identify potential areas of risk. For example, the 
Department of Homeland Security administers the Student and Exchange 
Visitor Information System--a database that tracks student nationality, 
school enrollment, and changes to major or field of study--but within 
the past 3 years neither State nor Commerce has requested these data 
from Homeland Security for the purposes of assessing export control 
risks. While a Commerce official indicated that the department would 
like to work with Homeland Security in the future, there is currently 
no information sharing between the two agencies for the purpose of 
identifying trends in student populations. Similarly, State does not 
use its Visas Mantis program--a security review procedure that aims to 
identify visa applicants who may pose a threat to U.S. national 
security by illegally transferring sensitive technology--to identify 
trends of foreign students and scholars and their fields of study, 
although it occasionally receives alerts about individuals who might 
pose an export control risk. 

To improve controls at universities, in 2005 Commerce solicited 
information on the impact of a proposed rule change that would have 
modified the definition of the use of export-controlled equipment by 
foreign nationals, which was recommended by the Commerce Office of 
Inspector General.[Footnote 19] Commerce received more than 300 
comments in which many cited the potential impact on university 
research, including numerous comments that the modified definition 
would capture too many routine operations carried out by students and 
employees and would thus create a large and generally unnecessary 
compliance, financial, and administrative burden for universities, and 
an increased licensing burden on Commerce. Subsequently, Commerce 
withdrew the advanced notice of proposed rule change in May 2006. 

Recently, U.S. export regulatory, oversight, and law enforcement 
agencies have taken some steps to engage the academic community on 
export issues. For example, in September 2006, Commerce established the 
Deemed Export Advisory Committee to address broad export control 
issues. Specifically, the committee's charter is to review and provide 
recommendations to Commerce on deemed export policy. Thus, this 
committee will be responsible for ensuring that the deemed export 
licensing policy protects national security while ensuring that the 
United States continues to be at the leading edge of technological 
innovations. Its membership includes high-ranking university officials 
and chief executive officers of companies. According to Commerce 
officials, the committee members will serve for approximately one year. 
Commerce officials stated that they plan to address the issue of 
fundamental research in the committee's work and to include 
participation by a number of export control agencies in committee 
meetings. Commerce highlighted one such issue in a May 2006 Federal 
Register notice where it described the difference between the academic 
community views that export controls would only apply to the results of 
research, and the Commerce view that export controls can also apply to 
the conduct of research. 

In September 2005, the Federal Bureau of Investigation established a 
separate forum to improve its lines of communication with the academic 
community. The National Security Higher Education Advisory Board-- 
consisting of the presidents and chancellors of several prominent U.S. 
universities--aims to foster outreach and to promote understanding 
between higher education and the Federal Bureau of Investigation. The 
board will provide insight on the higher education culture of openness, 
academic freedom, and international collaboration and dialogue on 
issues such as terrorism, counterintelligence, and homeland security. 
In addition, the Department of Homeland Security's Project Shield 
America aims to work with exporters of U.S. technologies that could be 
illegally exported, in particular, technologies used in weapons of mass 
destruction. According to a DHS official, the project's first outreach 
effort specifically targeting the U.S. academic community was scheduled 
to be held at the beginning of December 2006. 

Conclusions: 

Balancing the desire to attract gifted foreign research scientists to 
U.S. universities and the need to ensure that export-controlled 
research at universities is not compromised is a considerable 
challenge. Since government agencies place the responsibility for 
complying with export control regulations on universities and other 
exporting entities, it is essential that Commerce and State, the two 
agencies primarily charged with administering export regulations, 
understand whether universities correctly interpret and apply relevant 
export control policies and regulations when deciding whether their 
research is subject to export controls. Despite some concerns that 
universities may not understand their responsibilities when conducting 
research, Commerce and State have not leveraged available government 
information and assessed potential risks of illegal transfers of export-
controlled information at universities. Furthermore, although Commerce 
and State have separate export control jurisdictions, the lack of 
coordination between these agencies on outreach, analysis, and 
oversight could hamper their ability to determine whether export- 
controlled information may be at risk of transfer to foreign nationals 
in the course of university research. Without such knowledge, the 
government agencies cannot determine whether their guidance and 
training for universities is appropriate and sufficient and whether 
their resources are strategically targeted to optimize their ability to 
regulate and monitor universities' research. Until Commerce and State 
take such steps, sensitive information may remain vulnerable to 
improper transfer, potentially putting at risk U.S. national security 
interests. 

Recommendations for Executive Actions: 

To improve the Department of Commerce's oversight of export-controlled 
information under its jurisdiction at universities, we recommend that 
the Secretary of Commerce direct the Administrator of the Bureau of 
Industry and Security to: 

* strategically assess potential vulnerabilities in the conduct and 
publication of academic research by becoming more knowledgeable about 
research being conducted on university campuses and, in consultation 
with other agencies, make use of available information on technology 
development and foreign student populations at universities to assess 
the extent to which research at universities may be subject to export 
controls and: 

* on the basis of this assessment of university research and foreign 
student populations, improve interagency coordination, conduct 
additional outreach, and improve guidance to ensure that universities 
understand when to apply export controls. 

To improve the Department of State's oversight of export-controlled 
information under its jurisdiction at universities, we recommend that 
the Secretary of State direct the Director of the Directorate of 
Defense Trade Controls to: 

* strategically assess potential vulnerabilities in the conduct and 
publication of academic research by becoming more knowledgeable about 
research being conducted on university campuses and, in consultation 
with other agencies, make use of available information on technology 
development and foreign student populations at universities to assess 
the extent to which research at universities may be subject to export 
controls and: 

* on the basis of this assessment of university research and foreign 
student populations, improve interagency coordination, conduct 
additional outreach, and improve guidance to ensure that universities 
understand when to apply export controls. 

Agency Comments and our Evaluation: 

We provided a draft of this report to the Departments of Commerce, 
Defense, Homeland Security, and State for their review and comment. 
Commerce and State provided written comments, which are reprinted in 
appendixes II and III, respectively.[Footnote 20] Defense did not have 
any comments on our draft report. Homeland Security provided technical 
comments, which are incorporated as appropriate throughout the report. 

The Department of Commerce generally agreed with the report's 
recommendations, and stated that the Deemed Export Advisory Committee 
will aid in this respect. However, Commerce stated that Student and 
Exchange Visitor Information System (SEVIS) data are too general for 
use in identifying whether foreign students and scholars are subject to 
deemed export license requirements and that the collection of more 
specific visa application information is needed to assess 
vulnerabilities. While we agree that additional information from the 
visa application process could be useful, we found that SEVIS data 
include information that State and Commerce could use to perform 
general trend analysis to determine where best to focus outreach and 
compliance efforts at the university level. For example, an analysis of 
the majors that foreign students and scholars are pursuing at 
universities with large federal research contracts could provide 
Commerce and State with a proactive plan for targeting their outreach 
and training efforts for the academic community. Furthermore, while 
Commerce states that about one-third of its outreach events focus on 
the academic community, as our report states, we found that several of 
the events that Commerce classified as academic outreach were actually 
targeted at government research entities. Finally, Commerce correctly 
notes that our report focuses on fundamental research or other research 
that may be subject to export controls while excluding other research 
that falls outside of the export control universe. We identified the 
application of the fundamental research exclusion as a significant 
issue between the academic community and Commerce, and as Commerce's 
letter notes, some universities could benefit from a better 
understanding of deemed export control requirements. Our report 
indicates that an assessment of the vulnerabilities will best allow 
Commerce to focus its outreach and training efforts toward addressing 
this issue with the academic community. 

State agreed with our recommendation to improve interagency 
coordination on training and guidance for universities and disagreed 
with our report's finding that it does not assess the potential 
vulnerabilities associated with export-controlled information at 
academic institutions. State responded that it is currently working 
with the Department of Commerce and the Department of the Treasury to 
conduct an export control conference during 2007 specifically aimed at 
universities. As we recommended in our report, such outreach that is 
specifically targeted to the academic community, particularly in 
coordination with other agencies, could improve universities' 
understanding of regulations concerning export controlled information. 
However, while such outreach may help universities seeking guidance on 
deemed export regulations, State would benefit from strategically 
assessing vulnerabilities at universities using readily available data, 
such as SEVIS, to help the department identify and address areas of 
potential risk. While State disagreed with our recommendation, in its 
response it noted that it is considering conducting such an assessment. 
A trend analysis conducted on SEVIS and federal procurement data would 
be a valuable investment in providing a proactive plan for targeting 
outreach and training for universities. State also provided technical 
comments, which we incorporated throughout the report, as appropriate. 

We are sending copies of this report to appropriate congressional 
committees and to the Secretary of Commerce, the Secretary of Defense, 
the Secretary of Homeland Security, and the Secretary of State. Copies 
will be made available to others upon request. In addition, this report 
will be available at no charge on the GAO Web site at [Hyperlink, 
http://www.gao.gov]. 

If you or your staff have any questions about this report, please 
contact me on (202) 512-7333. Key contributors to this report are 
acknowledged in appendix IV. 

Sincerely, 

Signed by: 

John Hutton, Acting Director: 
Acquisition and Sourcing Management: 

[End of section] 

Appendix I: Scope and Methodology: 

To describe the nature of the research conducted at universities and 
identify the steps they have taken to comply with government export 
control regulations, we interviewed and obtained documentation from 
officials at 13 universities in positions such as vice chancellor for 
research, director of compliance, and general counsel. We conducted our 
review at the following 13 universities: Boston University, Boston, 
Massachusetts; California Institute of Technology, Pasadena, 
California; Carnegie Mellon University, Pittsburgh, Pennsylvania; 
Colorado State University, Fort Collins, Colorado; George Washington 
University, Washington, D.C; Johns Hopkins University, Baltimore, 
Maryland; Massachusetts Institute of Technology, Cambridge and 
Lexington, Massachusetts; Stanford University, Stanford, California; 
University of California at Berkeley; University of California at Los 
Angeles; University of Colorado at Boulder; University of Maryland at 
College Park; and the University of Southern California, Los Angeles, 
California. To get a general overview of the nature of research at 
universities, we also spoke by telephone with officials from the 
Association of American Universities, Association of University 
Technology Managers, National Council of University Research 
Administrators, and the Southwest Research Institute. To systematically 
select the universities that we visited, we cross-tabulated data on 
universities with large numbers of international students or scholars, 
those that are associated with federally funded research centers, those 
that had applied for International Traffic in Arms Regulations or 
Export Administration Regulations export licenses, and those that had 
high-dollar contracts with either the Department of Defense or other 
government entities. While some of the selected academic institutions 
fall within the top tiers across the selection criteria, their views 
stated in this report do not represent those of the entirety of the 
U.S. academic community. 

To assess Commerce's and State's efforts to determine the risk of 
export violations in university research, we interviewed officials from 
the Bureau of Industry and Security of the Department of Commerce and 
its related export offices: National Security and Technology Transfer 
Controls, Exporter Services, Export Administration, Export Enforcement. 
We also interviewed officials in the Department of Commerce's Offices 
of General Counsel and Inspector General. At the Department of State, 
we interviewed officials and reviewed data from the Bureau of Political-
Military Affairs' Directorate of Defense Trade Controls, the Bureaus of 
Consular Affairs and International Security and Nonproliferation, and 
the Office of the Inspector General. We obtained and analyzed 
regulations, guidance, and training documents from these departments. 
We also collected data and other documentation and met with officials 
from the Office of Defense Procurement and Acquisition Policy of the 
Department of Defense and the Department of Homeland Security's 
Immigration Policy Directorate and U.S. Immigration and Customs 
Enforcement. 

We conducted our work from March 2006 through November 2006 in 
accordance with generally accepted government auditing standards. 

[End of section] 

Appendix II: Comments from the Department of Commerce: 

The Secretary Of Commerce: 
Washington, D.C. 20230: 

Mr. John Hutton: 
Acting Director, Acquisition and Sourcing Management: 
Government Accountability Office: 
441 G Street, NW, Room 4718: 
Washington, DC 20548: 

Dear Mr. Hutton: 

Thank you for the opportunity to provide comments on two related 
Government Accountability Office (GAO) Draft Reports, Export Controls: 
Agencies Should Assess Vulnerabilities and Improve Guidance for 
Protecting Export-Controlled Information at Companies, GAO-07-69, and 
Export Controls: Agencies Should Assess Vulnerabilities and Improve 
Guidance on Protecting Export-Controlled Information at Universities, 
GAO-07-70. 

Along with a March 2004 report by the Commerce Department's Office of 
Inspector General (Inspection Report No. IPE-16176), these reports help 
draw attention to the importance of protecting sensitive export- 
controlled information without impeding the competitive position of 
U.S. industry and academia. Indeed, the issue of deemed exports is one 
that has received and continues to receive considerable attention from 
the Commerce Department's Bureau of Industry and Security (BIS). 

Noting that deemed exports under the Export Administration Regulations 
(EAR) are separate from technology transfer restrictions under the 
International Trade in Arms Regulations (ITAR), we generally agree with 
the reports' recommendations to assess potential vulnerabilities within 
industry and academia and then conduct more targeted deemed export 
outreach and compliance activities. As the reports note, BIS has 
already taken significant action in this regard. In September, the 
Commerce Department established the Deemed Export Advisory Committee 
(DEAC), co-chaired by Robert Gates, President of Texas A&M University, 
and Norman Augustine, retired Chairman and CEO of Lockheed Martin 
Corporation, to review the entire issue of deemed exports. (Dr. Gates 
was subsequently nominated by President Bush as Secretary of Defense, 
and we are in the process of identifying a replacement as co-chair.) 
The DEAC has high-level members from industry, academia, and the 
security field who will review and make recommendations to me on how 
best to ensure that transfers of sensitive technologies to foreign 
nationals protect vital national security interests while ensuring that 
U.S. companies and universities continue to be the world's leaders in 
research and development. 

In addition, BIS has expanded its already robust deemed export outreach 
program in all high-technology sectors, including universities, 
industry, and government laboratories. Significant outreach efforts 
have been undertaken with industry sectors and compliance officials on 
the requirements for deemed exports, including the requirement that 
license applications have in place a Technology Control Plan (TCP) to 
protect export-controlled information from unauthorized release. BIS 
publishes best practices guidance on TCPs on its website and discusses 
TCP requirements in enforcement outreach visits. Significantly, in 
September 2006, BIS officials addressed the annual convention of the 
American Society for Industrial Security (ASIS), a trade association of 
information and physical security management professionals, on the 
protection of export-controlled information and essential elements of 
TCPs in protecting such information from unauthorized access and 
release. 

In addition to its Fiscal Year 2005 pilot program for deemed export 
compliance verification, BIS has also initiated a formal Deemed Export 
Compliance Review Program. Under this program, BIS conducts formal 
compliance reviews of deemed export license holders' compliance with 
license conditions, including the efficacy of their required TCPs. 
Deemed export licenses are targeted for review based on the 
sensitivities of the technology involved (e.g., such as that connected 
with weapons of mass destruction development) and countries involved. 
BIS completed 14 reviews under this program in Fiscal Year 2006, and 
will continue reviews under the program in Fiscal Year 2007. 

Finally, BIS has worked closely with other agencies to gather data on 
potential risks of unauthorized technology transfers at universities. 
We have found that existing data, such as that found in the Department 
of Homeland Security's Student and Exchange Visitor Information System, 
is often too general to be useful in identifying whether foreign 
nationals will be subject to deemed export license requirements. 
Therefore, we have taken specific steps to improve this data, such as 
suggesting revisions to the relevant visa application form to collect 
information needed to assess technology transfer vulnerabilities from 
foreign nationals in the United States. 

Based on the Department's work to date and the findings of your reports 
and other studies, it is clear that some universities and research 
institutions need to acquire a better understanding of deemed export 
control requirements. Because we recognize the important need to 
improve understanding of deemed export license requirements at 
universities, about one-third of BIS's 120 annual deemed export 
outreach activities now focus on the academic community. At the same 
time, however, it is important to note that deemed export licensing 
consideration is required only if a foreign national has access to 
export-controlled technology. The EAR identifies a larger universe of 
information that is not subject to the Department's regulatory 
oversight and, therefore, is not export-controlled. The full context of 
this universe bears mentioning since it is not fully addressed in the 
report, which focuses primarily on the concept of fundamental research. 
As noted in Section 734.3(3) of the EAR, certain publicly available 
technology is not subject to the requirements of the EAR. This includes 
information that is already published or will be published. Section 
734.8 of the EAR clarifies that the information resulting from 
fundamental research which is intended for publication is considered 
publicly available and thus not subject to the EAR. 

Informed by the reports' findings and recommendations and actions taken 
to date, BIS will continue to assess vulnerabilities and work to more 
precisely target outreach and compliance efforts. BIS's efforts will 
also be significantly informed by the recommendations of the DEAC, 
which we currently expect to receive in the fall of 2007. 

Sincerely, 

Signed by: 

Carlos M. Gutierrez: 

[End of section] 

Appendix III: Comments from the Department of State: 

United States Department of State: 
Assistant Secretary for Resource Management and Chief Financial 
Officer: 
Washington, D.C., 20520: 

Ms. Jacquelyn Williams-Bridgers: 
Managing Director: 
International Affairs and Trade: 
Government Accountability Office: 
441 G Street, N. W. 
Washington, D.C. 20548-0001: 

Nov 30 2006: 

Dear Ms. Williams-Bridgers: 

We appreciate the opportunity to review your draft report, "Export 
Controls: Agencies Should Assess Vulnerabilities and Improve Guidance 
for Protecting Export-Controlled Information at Universities," GAO Job 
Code 120508. 

The enclosed Department of State comments are provided for 
incorporation with this letter as an appendix to the final report. 

If you have any questions concerning this response, please contact 
Patricia Slygh, Acting Director of Management, Bureau of Political and 
Military Affairs at (202) 663-2844. 

Sincerely, 

Signed by: 

Bradford R. Higgins: 

cc: GAO - John Neumann: 
PM - Gregory Suchan: 
State/OIG - Mark Duda: 

Department of State Comments on GAO Draft Report: 

Export Controls: Agencies Should Assess Vulnerabilities and Improve 
Guidance for Protecting Export-Controlled Information at Universities 
(GAO-07-70, GAO Code 120508): 

Thank you for allowing the Department of State the opportunity to 
comment on draft report "Export Control: Agencies Should Assess 
Vulnerabilities and Improve Guidance on Protecting Export-Controlled 
Information at Universities. " 

The report highlights the potential risks of foreign students at 
universities being exposed to export controlled technology with or 
without proper authorization and makes recommendations for both the 
Department of State and the Department: 

of Commerce regarding risk assessment and increased training and 
outreach for universities. The Department agrees with the GAO with 
respect to the need for increased training and outreach and is 
currently working with the Department of Commerce and the Department of 
Treasury to conduct an export control conference during 2007 
specifically aimed at universities. We disagree with the GAO's 
assertion that we are not presently assessing the risk of unauthorized 
data exports. While State's DDTC may not have concretely quantified the 
potential risk, there is a recognition that a risk exists. We estimate 
that it would take from one-half to one full man year to conduct an 
assessment and are presently determining if we can conduct the study, 
along with the planned outreach to universities in FY 2007, within the 
limits of existing resources. 

[End of section] 

Appendix IV: Staff Contact and Acknowledgments: 

GAO Contact: 

John P. Hutton (202) 512-7773: 

Acknowledgments: 

John Neumann, Sharron Candon, Gregory Harmon, Arturo Holguin, Angela 
Thomas, and Sandra Moore made key contributions to this report. Other 
key contributors include Marie Ahearn and Karen Sloan. 

FOOTNOTES 

[1] Dual-use information is that which has both commercial and military 
application. 15 C.F.R. Sec. 730.3. 

[2] National Security Decision Directive 189, issued September 21, 
1985, and still in effect, established national policy for controlling 
the flow of science, technology, and engineering information produced 
in federally-funded fundamental research at colleges, universities, and 
laboratories. The directive defines fundamental research to mean basic 
and applied research in science and engineering, the results of which 
ordinarily are published and shared broadly within the scientific 
community, as distinguished from proprietary research and from 
industrial development, design, production, and product utilization, 
the results of which ordinarily are restricted for proprietary or 
national security reasons. 

[3] Office of the National Counterintelligence Executive, Annual Report 
to Congress on Foreign Economic Collection and Industrial Espionage-- 
2004, NCIX 2005-10006, (Washington, D.C.: April 2005). 

[4] GAO, University Research: Most Federal Agencies Need to Better 
Protect against Financial Conflicts of Interest, GAO-04-31 (Washington, 
D.C., Nov. 14, 2003). 

[5] House of Representatives Committee on the Judiciary, Subcommittee 
on Immigration, Border Security, and Claims, Hearing on Sources and 
Methods of Foreign Nationals Engaged in Economic and Military 
Espionage, Serial No. 109-58, (Washington, D.C., Sept. 15, 2005). 

[6] The ITAR (22 C.F.R.§§ 120-130) implements the Arms Export Control 
Act (22 U.S.C. 2778). The Act authorizes the President to control the 
export of defense articles and services and promulgate corresponding 
regulations, which has been delegated to the Secretary of State by 
Executive Order 11958, as amended. The ITAR defines fundamental 
research to mean basic and applied research in science and engineering 
where the resulting information is ordinarily published and shared 
broadly within the scientific community, as distinguished from 
research, the results of which are restricted for proprietary reasons 
or specific U.S. government access and dissemination control. 22 C.F.R. 
sec.120.11 (a)(8). 

[7] The ITAR defines a foreign person as any natural person who is not 
a lawful permanent resident as defined by 8 U.S.C. sec. 1101(a)(20) or 
who is not a protected individual as defined by 8 U.S.C. 1324b(a)(3). 
It also means any foreign corporation, business association, 
partnership, trust, society, or any other entity or group that is not 
incorporated or organized to do business in the United States, as well 
as international organizations, foreign governments, and any agency or 
subdivision of foreign governments (e.g., diplomatic missions). 

[8] The EAR (15 C.F.R. §§ 730-774) implements the Export Administration 
Act (50 U.S.C. 2401-2420). Although the Act has lapsed, export 
regulations have been extended through executive orders, of which 
Executive Order 13222 (August 17, 2001) is the most recent. The EAR, 
like National Security Decision Directive 189, defines fundamental 
research to mean basic and applied research in science and engineering 
where the resulting information is ordinarily published and shared 
broadly within the scientific community. Such research can be 
distinguished from proprietary research and from industrial 
development, design, production, and product utilization, the results 
of which ordinarily are restricted for proprietary reasons or specific 
national security reasons. 15 C.F.R. sec.734.8. 

[9] The EAR defines a foreign national as a person who is not lawfully 
admitted for permanent residence in the United States or a person who 
is not a protected individual under the Immigration and Naturalization 
Act, 8 U.S.C. 1324b(a)(3). 15 C.F.R. sec.734.2 (b)(2)(ii). 

[10] These transfers are commonly referred to as "deemed" exports. 
Commerce's export control regulations (15 CFR 734.2(b)(2)(ii)) 
specifically utilize the term "deemed export" to describe these 
transfers. While the ITAR does not use a precise corresponding term, 
State Department officials told us the concept of a "deemed" export is 
covered under the ITAR's general definition of an export--that is, an 
export means "disclosing (including oral or visual disclosure) or 
transferring technical data to a foreign person, whether in the United 
States or abroad" (see 22 C.F.R. Sec. 120.17), and the ITAR's 
requirements for the export of unclassified technical data, which state 
"a license is required for the oral, visual or documentary disclosure 
of technical data by U.S. persons to foreign persons…regardless of the 
manner in which the technical data is transmitted (e.g., in person, by 
telephone, correspondence, electronic means, etc.)" (see 22 C.F.R. Sec. 
125.2(a) and (c)). State officials told us they also refer to these 
transfers as "deemed exports." 

[11] Defense Federal Acquisition Regulation 252.204-7000 prohibits the 
contractor from releasing any unclassified information to anyone 
outside of the contractor's organization unless the contracting officer 
has given prior written approval or the information is otherwise in the 
public domain before the date of release. 

[12] In 2005, DOD issued a proposed regulation that would have required 
contract officers to ensure that contracts identify any export- 
controlled information and technology and the contractor to not allow 
access by foreign nationals or persons to export-controlled information 
and technology without obtaining an export license, other 
authorization, or exemption. According to university associations, they 
were concerned that application of this regulation by contracting 
officers would not take into consideration whether export-controlled 
information is involved when restricting universities from sharing the 
results of fundamental research. 

[13] At the time of this report, the revised rule (2004-D010) had not 
been finalized. 

[14] The Society for International Affairs is a volunteer, nonprofit, 
educational organization jointly formed in 1967 by the federal 
government and industry. Its purpose is to serve as a forum for the 
exchange of information--through events such as luncheons, conferences, 
and workshops--related to export and import licensing issues. 

[15] The EAR and ITAR both impose criminal and civil penalties. 

[16] Offices of Inspectors General, Interagency Review of Foreign 
National Access to Export-Controlled Technology in the United States, 
Report No. D-2004-062 (Washington, D.C.: Apr. 16, 2004). 

[17] See GAO, Export Controls: Improvements to Commerce's Dual-Use 
System Needed to Ensure Protection of U.S. Interests in the Post-9/11 
Environment , GAO-06-638 (Washington, D.C.: Jun. 26, 2006); GAO, Export 
Controls: Department of Commerce Controls over Transfers of Technology 
to Foreign Nationals Need Improvement, GAO-02-972 (Washington, D.C.: 
Sept. 6, 2002); and GAO, Export Controls: Processes for Determining 
Proper Control of Defense-Related Items Need Improvement, GAO-02-996 
(Washington, D.C.: Sept. 20, 2002) 

[18] GAO, Standards for Internal Control in the Federal Government, 
GAO/AIMD-00-21.3.1 (Washington, D.C.: November 1999). 

[19] U.S. Department of Commerce, Office of Inspector General, Bureau 
of Industry and Security, Final Inspection Report No. IPE-16176, Deemed 
Export Controls May Not Stop the Transfer of Sensitive Technology to 
Foreign Nationals in the U.S. (Washington, D.C., Mar. 31, 2004). 

[20] Commerce's response letter also included comments on our draft 
report on export controlled information, Export Controls: Agencies 
Should Assess Vulnerabilities and Improve Guidance for Protecting 
Export-Controlled Information at Companies, GAO-07-69 (Washington, 
D.C.: Dec. 5, 2006). 

GAO's Mission: 

The Government Accountability Office, the audit, evaluation and 
investigative arm of Congress, exists to support Congress in meeting 
its constitutional responsibilities and to help improve the performance 
and accountability of the federal government for the American people. 
GAO examines the use of public funds; evaluates federal programs and 
policies; and provides analyses, recommendations, and other assistance 
to help Congress make informed oversight, policy, and funding 
decisions. GAO's commitment to good government is reflected in its core 
values of accountability, integrity, and reliability. 

Obtaining Copies of GAO Reports and Testimony: 

The fastest and easiest way to obtain copies of GAO documents at no 
cost is through GAO's Web site (www.gao.gov). Each weekday, GAO posts 
newly released reports, testimony, and correspondence on its Web site. 
To have GAO e-mail you a list of newly posted products every afternoon, 
go to www.gao.gov and select "Subscribe to Updates." 

Order by Mail or Phone: 

The first copy of each printed report is free. Additional copies are $2 
each. A check or money order should be made out to the Superintendent 
of Documents. GAO also accepts VISA and Mastercard. Orders for 100 or 
more copies mailed to a single address are discounted 25 percent. 
Orders should be sent to: 

U.S. Government Accountability Office 441 G Street NW, Room LM 
Washington, D.C. 20548: 

To order by Phone: Voice: (202) 512-6000 TDD: (202) 512-2537 Fax: (202) 
512-6061: 

To Report Fraud, Waste, and Abuse in Federal Programs: 

Contact: 

Web site: www.gao.gov/fraudnet/fraudnet.htm E-mail: fraudnet@gao.gov 
Automated answering system: (800) 424-5454 or (202) 512-7470: 

Congressional Relations: 

Gloria Jarmon, Managing Director, JarmonG@gao.gov (202) 512-4400 U.S. 
Government Accountability Office, 441 G Street NW, Room 7125 
Washington, D.C. 20548: 

Public Affairs: 

Paul Anderson, Managing Director, AndersonP1@gao.gov (202) 512-4800 
U.S. Government Accountability Office, 441 G Street NW, Room 7149 
Washington, D.C. 20548: